The devplatform-confirm-input npm package at version 35.9.8 is a malicious package that, upon require(), executes a script (_ext.js) which downloads a platform-specific binary from obfuscated Cloudflare Workers domains. The binary is saved to a temporary path with filenames designed to evade detection (e.g., dotnet_diag_*.exe or hidden.cache_*), permissions are set to executable, and it is spawned detached via cmd.exe or /bin/sh. If HTTPS download fails, a fallback channel using DNS-TXT records from specific domains is used to retrieve the payload. The package uses tokenized hostnames and cover-story identifiers to avoid static detection. This behavior results in remote code execution on the host system where the package is installed or imported.

Successful installation or import of [email protected] leads to remote code execution on the installer's host system. This allows an attacker to execute arbitrary code with the privileges of the user running the package, potentially leading to full system compromise. The use of obfuscation and fallback mechanisms increases the difficulty of detection and mitigation.

No official patch or remediation is currently documented for [email protected]. Users should avoid installing or importing this package version. Conduct thorough audits of dependencies before installation. Remove the package if already installed and scan affected systems for the presence of the malicious binary files (e.g., dotnet_diag_*.exe, hidden.cache_*). Monitor for suspicious network activity related to the identified C2 domains. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.